CVE-2026-87974

Deferred Deferred - Pending Action

Asaas Gateway for WooCommerce Payment Webhook Authentication Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-87974

EUVD

EUVD-2026-100858

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Asaas	Gateway for WooCommerce 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Asaas Gateway for WooCommerce WordPress plugin before version 2.7.8. It allows unauthenticated attackers to mark arbitrary orders as paid by bypassing payment verification. The issue occurs because the plugin accepts an empty access token by default and does not verify if the confirmed payment matches the order being marked as paid.

Detection Guidance

Check if the Asaas Gateway for WooCommerce plugin is installed and verify its version. If it is below 2.7.8, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

Unauthenticated attackers could exploit this to fraudulently mark orders as paid without actual payment, leading to financial losses for merchants. It may also disrupt order management and cause disputes with customers.

Compliance Impact

This vulnerability could lead to unauthorized transactions being marked as paid, potentially violating data integrity and access control requirements under GDPR and HIPAA. Unauthorized order modifications may expose sensitive payment or personal data to attackers, increasing risks of non-compliance with privacy and security controls.

Mitigation Strategies

Immediately update the Asaas Gateway for WooCommerce plugin to version 2.7.8 or later. If updating is not possible, consider disabling the plugin until an update is applied to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-87974. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70